Version: Windows 2025.5.893.0$$$Date: 2025-06-30$$$$$$Release notes$$$This release contains improvements and new exciting features; including SCCM VPN boundary support and post-quantum cryptography. By tunneling your corporate network traffic over Cloudflare; you can now gain the immediate protection of post-quantum cryptography without needing to upgrade any of your individual corporate applications or systems.$$$$$$Changes and improvements$$$$$$Fixed a device registration issue that caused WARP connection failures when changing networks.$$$Captive portal improvements and fixes:$$$Captive portal sign in notifications will now be sent through operating system notification services.$$$Fix for firewall configuration issue affecting clients in DoH only mode.$$$Improved the connectivity status message in the client GUI.$$$Fixed a bug affecting clients in Gateway with DoH mode where the original DNS servers were not restored after disabling WARP.$$$The WARP client now applies post-quantum cryptography end-to-end on enabled devices accessing resources behind a Cloudflare Tunnel. This feature can be enabled by MDM.$$$Improvement to handle client configuration changes made by an MDM while WARP is not running.$$$Improvements for multi-user experience to better handle fast user switching and transitions from a pre-login to a logged-in state.$$$Added a WARP client device posture check for SAN attributes to the client certificate check.$$$Fixed an issue affecting Split Tunnel Include mode; where traffic outside the tunnel was blocked when switching between Wi-Fi and Ethernet networks.$$$Added SCCM VPN boundary support to device profile settings. With SCCM VPN boundary support enabled; operating systems will register WARPs local interface IP with the on-premise DNS server when reachable.$$$Fix for an issue causing WARP connectivity to fail without full system reboot.$$$Known issues$$$$$$Microsoft has confirmed a regression with Windows 11 starting around 24H2 that may cause performance issues for some users. These performance issues could manifest as mouse lag; audio cracking; or other slowdowns. Microsofts recently released preview build; Windows 11 24H2 KB5060829; may resolve these issues.$$$$$$Devices with KB5055523 installed may receive a warning about Win32/ClickFix.ABA being present in the installer. To resolve this false positive; update Microsoft Security Intelligence to version 1.429.19.0 or later.$$$$$$DNS resolution may be broken when the following conditions are all true:$$$$$$WARP is in Secure Web Gateway without DNS filtering (tunnel-only) mode.$$$A custom DNS server address is configured on the primary network adapter.$$$The custom DNS server address on the primary network adapter is changed while WARP is connected.$$$To work around this issue; reconnect the WARP client by toggling off and back on.

Version: Windows 2025.4.943.0$$$Date: 2025-05-22$$$$$$Release notes$$$This release contains a hotfix for managed networks for the 2025.4.929.0 release.$$$$$$Changes and improvements$$$$$$Fixed an issue where it could take up to 3 minutes for the correct device profile to be applied in some circumstances. In the worst case; it should now only take up to 40 seconds. This will be improved further in a future release.$$$Known issues$$$$$$DNS resolution may be broken when the following conditions are all true:$$$$$$WARP is in Secure Web Gateway without DNS filtering (tunnel-only) mode.$$$A custom DNS server address is configured on the primary network adapter.$$$The custom DNS server address on the primary network adapter is changed while WARP is connected.$$$To work around this issue; reconnect the WARP client by toggling off and back on.$$$$$$We have received reports of performance issues from some customers that have upgraded to 24H2 with the Windows Filtering Platform and local device firewall rules. Before rolling out this Windows version; we highly encourage customers to test thoroughly as we continue to debug with Microsoft.$$$$$$Devices with KB5055523 installed may receive a warning about Win32/ClickFix.ABA being present in the installer. To resolve this false positive; update Microsoft Security Intelligence to version 1.429.19.0 or later.

Version: Windows 2025.4.943.0$$$Date: 2025-05-22$$$$$$Release notes$$$This release contains a hotfix for managed networks for the 2025.4.929.0 release.$$$$$$Changes and improvements$$$$$$Fixed an issue where it could take up to 3 minutes for the correct device profile to be applied in some circumstances. In the worst case; it should now only take up to 40 seconds. This will be improved further in a future release.$$$Known issues$$$$$$DNS resolution may be broken when the following conditions are all true:$$$$$$WARP is in Secure Web Gateway without DNS filtering (tunnel-only) mode.$$$A custom DNS server address is configured on the primary network adapter.$$$The custom DNS server address on the primary network adapter is changed while WARP is connected.$$$To work around this issue; reconnect the WARP client by toggling off and back on.$$$$$$We have received reports of performance issues from some customers that have upgraded to 24H2 with the Windows Filtering Platform and local device firewall rules. Before rolling out this Windows version; we highly encourage customers to test thoroughly as we continue to debug with Microsoft.$$$$$$Devices with KB5055523 installed may receive a warning about Win32/ClickFix.ABA being present in the installer. To resolve this false positive; update Microsoft Security Intelligence to version 1.429.19.0 or later.

Version: Windows 2025.4.929.0$$$Date: 2025-05-14$$$Size: 130 MB$$$Download$$$$$$Release notes$$$This release contains two significant changes all customers should be aware of:$$$$$$All DNS traffic now flows inside the WARP tunnel. Customers are no longer required to configure their local firewall rules to allow our DoH IP addresses and domains.$$$When using MASQUE; the connection will fall back to HTTP/2 (TCP) when we detect that HTTP/3 traffic is blocked. This allows for a much more reliable connection on some public WiFi networks.$$$Changes and improvements$$$$$$Fixed an issue causing reconnection loops when captive portals are detected.$$$Fixed an issue that caused WARP client disk encryption posture checks to fail due to missing drive names.$$$Fixed an issue where managed network policies could incorrectly report network location beacons as missing.$$$Improved DEX test error reporting.$$$Fixed an issue where some parts of the WARP Client UI were missing in high contrast mode.$$$Fixed an issue causing client notifications to fail in IPv6 only environments which prevented the client from receiving configuration changes to settings like device profile.$$$Added a TCP fallback for the MASQUE tunnel protocol to improve connectivity on networks that block UDP or HTTP/3 specifically.$$$Added new IP addresses for tunnel connectivity checks. If your organization uses a firewall or other policies you will need to exempt these IPs.$$$DNS over HTTPS traffic is now included in the WARP tunnel by default.$$$Improved the error message displayed in the client GUI when the rate limit for entering an incorrect admin override code is met.$$$Improved handling of non-SLAAC IPv6 interface addresses for better connectivity in IPv6 only environments.$$$Fixed an issue where frequent network changes could cause WARP to become unresponsive.$$$Improvement for WARP to check if tunnel connectivity fails or times out at device wake before attempting to reconnect.$$$Fixed an issue causing WARP connection disruptions after network changes.$$$Known issues$$$$$$DNS resolution may be broken when the following conditions are all true:$$$$$$WARP is in Secure Web Gateway without DNS filtering (tunnel-only) mode.$$$A custom DNS server address is configured on the primary network adapter.$$$The custom DNS server address on the primary network adapter is changed while WARP is connected.$$$To work around this issue; reconnect the WARP client by toggling off and back on.$$$$$$We have received reports of performance issues from some customers that have upgraded to 24H2 with the Windows Filtering Platform and local device firewall rules. Before rolling out this Windows version; we highly encourage customers to test thoroughly as we continue to debug with Microsoft.$$$$$$Devices with KB5055523 installed may receive a warning about Win32/ClickFix.ABA being present in the installer. We are working with Microsoft to correct this issue.

Release notes$$$This release contains a hotfix for captive portal detection for the 2025.2.600.0 release.$$$$$$Changes and improvements$$$$$$Fix to reduce the number of browser tabs opened during captive portal logins.$$$Known issues$$$$$$DNS resolution may be broken when the following conditions are all true:$$$$$$WARP is in Secure Web Gateway without DNS filtering (tunnel-only) mode.$$$A custom DNS server address is configured on the primary network adapter.$$$The custom DNS server address on the primary network adapter is changed while WARP is connected.$$$To work around this issue; reconnect the WARP client by toggling off and back on.

Release Notes$$$This release contains only improvements.$$$$$$Changes and improvements$$$Improved command line interface for Zero Trust Access for Infrastructure with added function for filtering and ordering.$$$Fixed client connectivity issues when switching between managed network profiles that use different WARP protocols.$$$Added support for WARP desktop to use additional DoH endpoints to help reduce NAT $$$ congestion.$$$Improved Windows multi-user feature with minor bug fixes and optimizations.$$$Improved connectivity check reliability in certain split tunnel configurations.$$$Improved reading of device DNS settings at connection restart.$$$Improved WARP connectivity in environments with virtual machine interfaces.$$$Improved Wireguard connection stability on reconnections.$$$Improved reliability of device posture checks for OS Version; Unique Client ID; Domain Joined; Disk Encryption; and Firewall attributes.$$$Added additional HTTP/3 QUIC connectivity test to warp-diag.$$$Added support for collection of system health metrics for enhanced device Digital Experience Monitoring.$$$Automated the removal of active registrations for devices with multiple registrations with the same Zero Trust organization.$$$$$$Known issues$$$DNS resolution may be broken when the following conditions are all true:$$$ 1. WARP is in Secure Web Gateway without DNS filtering (tunnel-only) mode.$$$ 2. A custom DNS server address is configured on the primary network adapter.$$$ 3. The custom DNS server address on the primary network adapter is changed while WARP is connected.$$$To work around this issue; please reconnect the WARP client by toggling off and back on.

This release contains only a hotfix from the 2024.12.554.0 release$$$$$$Changes and improvements$$$Fixed an issue that could prevent clients with certain split tunnel configurations from connecting$$$Known issues$$$DNS resolution may be broken when the following conditions are all true:$$$$$$WARP is in Secure Web Gateway without DNS filtering (tunnel-only) mode.$$$A custom DNS server address is configured on the primary network adapter.$$$The custom DNS server address on the primary network adapter is changed while WARP is connected.$$$To work around this issue; please reconnect the WARP client by toggling off and back on.

Version 2024.12.554.0$$$Dec 20; 2024 at 03:54$$$120.36 MB$$$This release contains improvements to support custom gateway certificate installation in addition to the changes and improvements included in release Version 2024.12.492.0.$$$$$$Changes and improvements$$$Adds support for installing all available custom gateway certificates from an account to the system store.$$$Users can now get a list of installed certificates by running warp-cli certs.$$$Known issues$$$DNS resolution may be broken when the following conditions are all true:$$$$$$WARP is in Secure Web Gateway without DNS filtering (tunnel-only) mode.$$$A custom DNS server address is configured on the primary network adapter.$$$The custom DNS server address on the primary network adapter is changed while WARP is connected.$$$To work around this issue; please reconnect the WARP client by toggling off and back on.$$$$$$For Zero Trust documentation please see: https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp$$$$$$For Consumer documentation please see: https://developers.cloudflare.com/warp-client/

Version 2024.11.309.0$$$Nov 19; 2024 at 03:27$$$117.42 MB$$$This release contains minor fixes and improvements.$$$$$$Changes and improvements$$$Fixed an issue where SSH sessions and other application connections over TCP or UDP could be dropped when using MASQUE and the devices primary network interface changed.$$$Fixed an issue to ensure the managed certificate is installed in the trust store if not already there.$$$Fixed an issue with the WARP client becoming unresponsive during startup.$$$Extended diagnostics collection time in warp-diag to ensure logs are captured reliably.$$$Fixed an issue that was preventing proper operation of DNS-over-TLS (DoT) for consumer users.$$$Known issues$$$DNS resolution may be broken when the following conditions are all true:$$$$$$WARP is in Secure Web Gateway without DNS filtering (tunnel-only) mode.$$$A custom DNS server address is configured on the primary network adapter.$$$The custom DNS server address on the primary network adapter is changed while WARP is connected.$$$To work around this issue; please reconnect the WARP client by toggling off and back on.

Version 2024.9.346.0$$$Oct 04; 2024$$$This release contains minor fixes and improvements.$$$Changes and improvements$$$Added list targets to the warp-cli to enhance the user experience with the Access for Infrastructure SSH solution.$$$Added pre-login configuration details to the warp-diag output.$$$Added a tunnel reset mtu subcommand to the warp-cli.$$$Added a JSON output option to the warp-cli.$$$Added the ability for warp-cli to use the team provided in the MDM file for initial registration.$$$Added the ability to execute a pcap on multiple interfaces with warp-cli and warp-dex.$$$Improved warp-dex default interface selection for pcaps; changed warp-dex cli output to JSON.$$$Fixed an issue where the client; when switching between WireGuard and MASQUE protocols; sometimes required a manual tunnel key reset.$$$Added MASQUE tunnel protocol support for Consumer WARP.$$$Known issues$$$Using MASQUE as the tunnel protocol may be incompatible if your organization has Regional Services enabled.

Version 2024.8.458.0$$$Sep 26; 2024 at 23:45$$$115.29 MB$$$This release contains minor fixes and improvements.$$$$$$Notable updates$$$Added the ability to customize PCAP options in the warp-cli.$$$Added a list of installed applications in warp-diag.$$$Added a summary of warp-dex traceroute results in its JSON output.$$$Improved the performance of firewall operations when enforcing split tunnel configuration.$$$Reduced the time it takes for a WARP client update to complete.$$$Fixed an issue where clients using service tokens failed to retry the initial connection when there is no network connectivity on startup.$$$Fixed issues where incorrect DNS server addresses were being applied following reboots and network changes. Any incorrect static entries set by previous WARP versions must be manually reverted.$$$Fixed a known issue which required users to re-register when an older single configuration MDM file was deployed after deploying the newer; multiple configuration format.$$$Deprecated warp-cli commands have been removed. If you have any workflows that use the deprecated commands; please update to the new commands where necessary.$$$Known issues$$$Using MASQUE as the tunnel protocol may be incompatible if your organization has Regional Services enabled.$$$DNS resolution may be broken when the following condition are all true:$$$WARP is in Secure Web Gateway without DNS filtering (tunnel-only) mode.$$$A custom DNS server address is configured on the primary network adapter.$$$The custom DNS server address on the primary network adapter is changed while WARP is connected.$$$To work around this issue; please reconnect the WARP client by toggling off and back on.$$$For Zero Trust documentation please see: https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp For Consumer documentation please see: https://developers.cloudflare.com/warp-client/

Version 2024.6.473.0$$$Jul 31; 2024 at 01:25$$$114.09 MB$$$This release only contains a hotfix from the 2024.6.415.0 release.$$$$$$Notable updates$$$Fixed an issue which could cause alternate network detections to fail for hosts using TLS 1.2 which do not support TLS Extended Master Secret (EMS).$$$Improved the stability of device profile switching based on alternate network detection.$$$Known issues$$$If a user has an MDM file configured to support multiple profiles (for the switch configurations feature); and then changes to an MDM file configured for a single profile; the WARP client may not connect. The workaround is to use the warp-cli registration delete command to clear the registration; and then re-register the client.$$$There are certain known limitations preventing the use of the MASQUE tunnel protocol in certain scenarios. Do not use the MASQUE tunnel protocol if:$$$A Magic WAN integration is on the account and is not yet migrated to the warp_unified_flow. Please check migration status with your account team.$$$Your account has Regional Services enabled.$$$For Zero Trust documentation please see: https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp$$$For Consumer documentation please see: https://developers.cloudflare.com/warp-client/

Version 2024.6.415.0$$$Jun 28; 2024 at 22:31$$$113.71 MB$$$This release includes some exciting new features. It also includes additional fixes and minor improvements.$$$$$$New features$$$Admins can now elect to have ZT WARP clients connect using the MASQUE protocol; this setting is in Device Profiles. Note: before MASQUE can be used; the global setting for Override local interface IP must be enabled. For more detail; see https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#device-tunnel-protocol. This feature will be rolled out to customers in stages over approximately the next month.$$$The ZT WARP client on Windows devices can now connect before the user completes their Windows login. This Windows pre-login capability allows for connecting to on-premise Active Directory and/or similar resources necessary to complete the Windows login.$$$The Device Posture client certificate check has been substantially enhanced. The primary enhancement is the ability to check for client certificates that have unique common names; made unique by the inclusion of the device serial number or host name (for example; CN = 123456.mycompany; where 123456 is the device serial number). Additional details can be found here: https://developers.cloudflare.com/cloudflare-one/identity/devices/warp-client-checks/client-certificate/$$$Additional changes and improvements$$$Added a new message explaining why WARP was unable to connect; to help with troubleshooting.$$$The upgrade window now uses international date formats.$$$Made a change to ensure DEX tests are not running when the tunnel is not up due to the device going to or waking from sleep. This is specific to devices using the S3 power model.$$$Fixed a known issue where the certificate was not always properly left behind in %ProgramData%\Cloudflare\installed_cert.pem.$$$Fixed an issue where ICMPv6 Neighbor Solicitation messages were being incorrectly sent on the WARP tunnel.$$$Fixed an issue where a silent upgrade was causing certain files to be deleted if the target upgrade version is the same as the current version.

Version 2024.3.409.0$$$Mar 30; 2024 at 04:05$$$110.91 MB$$$This release contains no new features and is focused exclusively on improvements.$$$$$$Notable updates$$$Windows client downloads will now contain version numbers in the file name to allow easy identification.$$$Enabled re-authentication and other notifications to always be shown (without sound) regardless of Windows Focus Assist settings.$$$Suppressed the GUI certificate error message Limited connectivity: A certificate missing; please contact your administrator for a scenario where it was not needed.$$$Improved the re-connection logic to minimize impact to existing tunneled TCP sessions.$$$Corrected an issue where the DNS server information was being improperly persisted across network changes.$$$Increased the data collected by warp-diag to improve debugging capabilities.$$$Known issues$$$When Install CA to system certificate store is enabled; the certificate is not always properly left behind in %ProgramData%\Cloudflare\installed_cert.pem. This issue will be fixed in a future release.

Version 2024.2.187.0$$$Mar 01; 2024 at 02:33$$$109.63 MB$$$This release contains no new features and is focused exclusively on improvements.$$$$$$Notable updates$$$$$$Improved error handling to avoid causing an unnecessary reconnection when the Windows networking subsystem is under load.$$$Known issues$$$When Install CA to system certificate store is enabled; the certificate is not always properly left behind in %ProgramData%\Cloudflare\installed_cert.pem. This issue will be fixed in a future release.$$$For Zero Trust documentation please see: https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp$$$For Consumer documentation please see: https://developers.cloudflare.com/warp-client/

Version 2024.1.159.0$$$Jan 25; 2024 at 00:14$$$109.8 MB$$$This release contains a number of exciting new features and several improvements and bug fixes.$$$$$$Notable updates$$$Added the ability for the Client to display Gateway NETWORK and HTTP block notifications to the user.$$$Added the ability for administrators to specify multiple configurations in MDM files that users can toggle between. This allows users to more easily switch between production and test environments or for China users to switch between their override endpoints within the UI.$$$Added the ability for administrators to allow their end users to temporarily obtain access to local network resources in the event their home IP space overlaps with traffic normally routed through the WARP tunnel.$$$Improved existing re-auth notifications to be more visible and time sensitive.$$$Improved the handling of DNS server addresses to avoid conflicts with Windows OS setting of DHCP-sourced DNS server addresses.$$$Improved the retry mechanisms for DEX test results.$$$Improved the Device Posture Firewall check on Windows to ensure that all policy stores are checked.$$$Fixed an issue where DEX tests would run before the client was fully connected.$$$Known issues$$$No known issues.$$$For Zero Trust documentation please see: https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp For Consumer documentation please see: https://developers.cloudflare.com/warp-client/

Version 2023.12.3.0$$$Dec 02; 2023 at 02:00$$$108.33 MB$$$This releases contains bug fixes only; no new functionality has been introduced$$$$$$Notable updates$$$Fixed an issue where multicast traffic was being sent down the tunnel when it shouldnt be. Traffic to 224.0.0.0/4 is now always excluded from the tunnel$$$Fixed an issue where we would not properly restore DNS servers to the current DHCP value but instead restoring to last DHCP value saved. This caused issues going between multiple different networks (going from home to work or a hotel with a completely different network)$$$Fixed an issue for users with domain based split tunnel rules that could prevent access to certain sites due to Windows automatically adding/deleting broadcast routes in related IP ranges. This error resulted in users not being able to visit sites with IP addresses in the ranges impacted by the domain based split tunnel rule$$$Fixed an issue where we were incorrectly setting the default local domain fallback server value for entries without an explicit DNS server set

Version 2023.9.248.0$$$Sep 28; 2023 at 01:53$$$107.14 MB$$$This release contains significant improvements to reliability and a number of exciting new features.$$$$$$Notable updates$$$Added connectivity error reasons to the UI. Examples of this UI and the types of errors your users will see can be found in the client errors documentation$$$Added new posture type: Client certificate$$$Added support for IPv6 DEX Traceroute tests (previously only IPv4 addresses could be used)$$$Improved reliability and efficiency in configurating split tunnel rules. Most error petting the dog errors should now be gone and organizations with large split tunnel configuration should see reliability improvements.$$$Fixed an issue where warp-svc could crash under extreme load$$$Fixed an issue where the Windows GUI could spam the Windows System Eventlog with unhelpful error messages$$$Fixed an issue with DEX traceroutes tests where not all hops were correctly reported$$$Fixed an issue where DEX tests would not properly run immediately after a device came out of sleep$$$Fixed an issue where DEX tests would execute simultaneously causing performance issues for accounts with a large number of tests configured$$$Fixed an issue where DNS status would flap between Connected / Disconnect in Connectivity panel$$$Fixed an issue where DoH requests could take too long to timeout causes DNS reliability issues$$$Fixed an issue that was causing Windows BSOD (DPC_WATCHDOG_VIOLATION)$$$Fixed an issue where DNS could temporarily fail when DHCP updates were processed$$$Fixed an issue on initial device registration that could sometimes cause it to fail and try again$$$Fixed an issue where UI could appear in the wrong location when the app starts$$$Fixed an issue where short DNS timeouts were causing issues with some captive portals (United in particular)$$$Fixed an issue where managed network detection could fail when our firewall rules were not correctly removed under certain disconnect scenarios$$$Fixed an issue with Managed Networks where if the managed endpoint overlapped with your exclude split tunnel configuration; the split tunnel would only be open for IP traffic destined to the same port as your managed TLS endpoint$$$Fixed an issue where IPv6 traffic could be incorrectly sent down the tunnel in exclude mode$$$Known issues$$$No known issues$$$For Zero Trust documentation please see: https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp For Consumer documentation please see: https://developers.cloudflare.com/warp-client/

Version 2023.3.450.0$$$Apr 28; 2023 at 04:32$$$101.78 MB$$$This is a Windows only hotfix from the 2023.3.412.0 release$$$$$$Notable updates$$$Fixed issue where certain split tunnel configurations with certain multicast IPs not excluded couldnt connect. 224.0.0.0/4 and ff00::/8 are now always excluded from the tunnel on Windows.$$$Fixed a connectivity issue that was more likely to happen for clients with large host-based split tunnel rules$$$Known issues$$$No known issues$$$$$$For Zero Trust documentation please see: https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp For Consumer documentation please see: https://developers.cloudflare.com/warp-client/